From: Roland Dreier <rolanddreier@rivian.com>

When the is_transport_polling_capable() check fails in scmi_raw_message_send(),
it returns -EINVAL without doing scmi_xfer_raw_put(), which will leak a
struct scmi_xfer.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260909-scmi-async-done-race-v2-0-cc5dec25c6be%40rivian.com
Fixes: 07cb8c324b63 ("firmware: arm_scmi: Add polling support to raw mode")
Signed-off-by: Roland Dreier <rolanddreier@rivian.com>
---
Sashiko pointed out this pre-existing bug when reviewing my patchset:
https://sashiko.dev/#/patchset/20260909-scmi-async-done-race-v2-0-cc5dec25c6be%40rivian.com

Fix is trivial so sending it out.
---
 drivers/firmware/arm_scmi/raw_mode.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/firmware/arm_scmi/raw_mode.c b/drivers/firmware/arm_scmi/raw_mode.c
index 1f6e51670208..279fee7c6ce9 100644
--- a/drivers/firmware/arm_scmi/raw_mode.c
+++ b/drivers/firmware/arm_scmi/raw_mode.c
@@ -694,6 +694,7 @@ static int scmi_raw_message_send(struct scmi_raw_mode_info *raw,
 		} else {
 			dev_err(raw->handle->dev,
 				"Failed to send RAW message - Polling NOT supported\n");
+			scmi_xfer_raw_put(raw->handle, xfer);
 			return -EINVAL;
 		}
 	}

---
base-commit: 893e11787f78e43b534e252249ac3fff4d1333f8
change-id: 20260909-scmi-raw-0ff3feb5a073

Best regards,
--  
Roland Dreier <rolanddreier@rivian.com>

On Wed, 09 Sep 2026 17:58:59 +0000, Roland Dreier wrote:
> When the is_transport_polling_capable() check fails in scmi_raw_message_send(),
> it returns -EINVAL without doing scmi_xfer_raw_put(), which will leak a
> struct scmi_xfer.

Applied to sudeep.holla/linux (for-next/scmi/updates), thanks!

[1/1] firmware: arm_scmi: Fix error path leak in scmi_raw_message_send()
      https://git.kernel.org/sudeep.holla/c/1adabdce41b9
-- 
Regards,
Sudeep